Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (CVE-2026-48817) | HOL Guard CVE